No business is immune to cyber attacks. Ransomware was involved in 48% of breaches in Verizon’s 2026 Data Breach Investigations Report, and attackers increasingly get in through unpatched systems and suppliers. What separates a bad week from a business-ending disaster is usually preparation: a clear, rehearsed cyber attack recovery plan that tells everyone what to do in the first hours and days. This guide walks through how to build one in 2026.
Incident Response vs Disaster Recovery
- Incident response deals with the attack itself: detecting it, containing it, removing the attacker and understanding what happened.
- Disaster recovery restores systems and data so the business can operate again.
A cyber attack recovery plan needs both. Restoring systems before the attacker is removed often leads to reinfection. For the broader recovery side (hardware failure, natural disasters, outages), see our disaster recovery plan guide.
Before an Attack: Preparation
1. Build the team and contact list
Name an incident lead and backups, plus technical responders, management, legal, communications and HR contacts. Include external contacts: your IT or security provider, cyber insurer, lawyers, forensics firm and, where relevant, regulators or CERT-In for organisations in India. Keep the list offline as well as online, because email may be down during an attack.
2. Know your critical systems
List the systems and data the business can’t run without, who owns them, and how quickly each must be restored (RTO) and how much data loss is acceptable (RPO).
3. Make backups attack-proof
- Follow the 3-2-1 rule with at least one immutable or offline copy that ransomware can’t reach.
- Use separate credentials for backup systems, protected by MFA.
- Test full restores regularly, not just file-level checks.
4. Prepare logging and detection
Central, tamper-resistant logs and good monitoring let you detect attacks early and understand them afterwards. See our guides to Linux server auditing and infrastructure monitoring tools.
5. Write playbooks and rehearse
Prepare short, step-by-step playbooks for likely scenarios: ransomware, compromised email account, website defacement, data leak and compromised server. Run a tabletop exercise at least once a year.
During an Attack: The Response Steps
Step 1: Detect and assess
Confirm what is happening, which systems are affected, and how serious it is. Start an incident log straight away, recording times, actions and decisions.
Step 2: Contain
- Isolate affected systems from the network (disconnect, don’t power off, so that evidence in memory is preserved where possible).
- Disable compromised accounts and revoke sessions, API keys and tokens.
- Block malicious IPs and domains at the firewall.
- Protect backups by disconnecting or locking them if there is any risk the attacker can reach them.
Step 3: Preserve evidence
Take disk and memory snapshots of key systems and keep logs before they rotate. Evidence matters for understanding the attack, insurance claims and any legal or regulatory requirements.
Step 4: Communicate
Keep management informed. Notify your insurer early, as many policies require it. Check legal obligations: data protection laws (such as GDPR or India’s DPDP Act) and sector rules may require notifying regulators or affected people within strict timelines. Use pre-approved message templates and a single spokesperson.
Step 5: Eradicate
Find and remove the attacker’s access: malware, backdoors, rogue accounts, scheduled tasks and stolen credentials. Identify and fix the original entry point, whether an unpatched system, a phished account or a vulnerable plugin. Rebuilding compromised servers from clean images is usually safer than cleaning them.
Under attack right now?
Our security engineers handle malware cleanup, server recovery and incident response 24/7.
After an Attack: Recovery
Step 6: Restore safely
- Restore from backups you have verified are clean, taken before the compromise.
- Rebuild servers from hardened, patched images. Infrastructure as code makes this much faster. See infrastructure as code.
- Reset all relevant passwords and keys, and enforce MFA.
- Bring systems back in priority order and monitor closely for signs of the attacker returning.
Step 7: Learn and improve
Hold a blameless post-incident review within two weeks. What happened, how was it detected, what worked, what didn’t, and what will change? Update playbooks, fix root causes and track the actions to completion.
Should You Pay a Ransom?
Most authorities advise against paying. Payment doesn’t guarantee working decryption keys or deletion of stolen data, it funds further attacks, and in some cases it may breach sanctions laws. Verizon’s 2026 report found 69% of ransomware victims didn’t pay. Tested, immutable backups are what make refusing to pay possible. Any decision should involve management, legal advisers and your insurer.
Cyber Attack Recovery Checklist
- Incident team and offline contact list ready
- Critical systems with RTO and RPO defined
- Immutable, tested backups with separate credentials
- Central logging and monitoring in place
- Playbooks for top scenarios, rehearsed yearly
- Insurer, legal and forensics contacts agreed in advance
- Communication templates prepared
- Post-incident review process defined
Frequently Asked Questions
What should be done first after a cyber attack?
Contain it: isolate affected systems, disable compromised accounts and protect your backups. Then preserve evidence and bring in your response team.
How long does recovery from a ransomware attack take?
Anything from days to several weeks, depending on preparation. Businesses with tested, immutable backups and rehearsed plans recover far faster.
Do small businesses need an incident response plan?
Yes. Even a two-page plan with contacts, priorities and first steps makes a big difference when every hour counts.
Should we involve outside experts?
For anything beyond a minor incident, yes. Specialists contain attacks faster, preserve evidence properly and help you avoid reinfection.
How VIPoint Can Help
VIPoint Solutions has helped hosting companies and businesses recover from hacked servers, malware and ransomware since 2012. Our engineers in Infopark, Kochi provide 24/7 incident response, malware cleanup, server rebuilds, backup and disaster recovery and ongoing hardening, so you are better prepared before an attack happens.
Get a free security audit of your server
Our Linux engineers will review one server or website from the outside and send you a prioritised fix list within 2 business days. No agents, no access, no obligation.